Plan and Manage Compliance

Compliance requirements can be external (laws, industry regulations, standards like data-privacy law) or internal (organizational policy, security standards). The PM's job is to identify which apply early — usually during initiation/planning — and build verification steps into the project rather than discovering a gap during an external audit.

A recurring exam scenario: a compliance issue is discovered mid-project. The correct response sequence is typically: assess the impact and risk, report through the proper channel (which may include legal/compliance functions beyond the PM's own authority), and take corrective action — not quietly fix it and move on, and not necessarily halt the entire project unless the severity demands it.

Study focus: PMI tests the PM's obligation to escalate compliance issues even when doing so is inconvenient for the schedule — "protect the project's reputation and legal standing" outranks "protect the timeline" in PMI's ethical framework.